CVE-2015-5295 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Orchestration API
Severity
5.4MEDIUMNVD
EPSS
1.6%
top 18.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 20
Latest updateMay 14
Description
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LExploitability: 2.8 | Impact: 2.5
Affected Packages4 packages
Also affects: Fedora 23
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-2w55-prvj-mgc2: The template-validate command in OpenStack Orchestration API (Heat) before 2015↗2022-05-14
OSV▶
CVE-2015-5295: The template-validate command in OpenStack Orchestration API (Heat) before 2015↗2016-01-20
CVEList▶
CVE-2015-5295: The template-validate command in OpenStack Orchestration API (Heat) before 2015↗2016-01-20